Privacy
What this site collects, why, how long it is kept, and how to have it removed. In plain language, because we would want the same.
Last updated 4 September 2026
Who we are
The Spiral is a software and automation studio based in Tirana, Albania. We decide what is collected on this site and why, which under the GDPR makes us the data controller. For anything on this page, write to info@thespiral.studio.
When you send us a brief
The contact form asks for your name, work email, company and a description of what you need. It records which page you sent it from, so we know what you were reading. All of it goes straight to our inbox as an email, through the sending service Resend. We do not put it in a database, and we do not add you to a mailing list.
We use it for one thing: replying to you and, if it goes further, doing the work. The lawful basis is our legitimate interest in answering people who ask us a question, and, once there is a project, performing the contract.
The form also counts submissions per IP address for a minute at a time, so that nobody can flood it. That count is held in memory, never written down, and gone within the minute.
Analytics
We use Google Analytics 4 to count visits and see which pages people read. Nothing is stored on your device until you accept the banner. If you accept, Google sets two cookies, _ga and _ga_R07Y5DLZL7, which distinguish one browser from another for up to two years. If you decline, no cookie is set and no identifier is kept.
Before you choose, and if you decline, the Google tag still sends one anonymous signal per page so that Google can estimate totals. It carries no cookie and no identifier for you. Advertising features, personalisation and ad measurement are switched off, and click identifiers are stripped.
To change your mind, clear this site's data in your browser and the banner will ask again.
Hosting and logs
The site runs on Vercel, whose servers keep the usual short-lived request logs, including IP addresses, to serve pages and defend against abuse. Typefaces are loaded from Google Fonts, which means your browser makes a request to Google to fetch them.
Who else sees it
Only the services that make the site work: Vercel for hosting, Resend for delivering your message, Zoho for our mailbox, and Google for analytics and fonts. We do not sell anything to anyone, and we do not share your details with other clients or with advertisers.
How long we keep it
Enquiry emails stay in our inbox while there is a reason to keep them, which for a live or recent project means the length of the work and a reasonable period after it. Analytics data is held by Google for 14 months and then deleted. If you would rather we removed your enquiry sooner, ask and we will.
Your rights
If you are in the EU, the UK or Albania you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. One email to info@thespiral.studio is enough, and we will answer within a month. If you think we have handled it badly you can complain to your national data protection authority, or to the Information and Data Protection Commissioner in Albania.
Changes
If this page changes in a way that matters, the date at the top changes with it.